News
WhatsApp new privacy policy raises concerns among cyber security analysts here
As social media messaging app WhatsApp introduced a new user privacy policy to extract sweeping personal user data to be shared with its mother company Facebook, users in Sri Lanka are less informed about its consequences in the absence of data privacy legislation, according to cyber security analysts.
Early this week, WhatsApp users received a notification about key updates including information of how it “processes user’s data” and how businesses can use Facebook hosted services to store and manage their WhatsApp chats.
Another bullet point in the notification was how the messaging app partners with Facebook to offer integrations across the Facebook company products.
Once the user tapped “Agree”, the messaging app indicated that the user accepted the new terms and privacy policy which came into effect from Friday as the company announced earlier. Those who declined to accept the update will not be able to access the app in future.
If you have an iPhone, its App store indicates what kind of user data information is being collected through Facebook company products such as WhatsApp and Facebook Messenger which extracts comprehensive data from the user compared to WhatsApp.
The data both apps collect includes users’ purchase history, financial information, location details, contacts, phone number, email address, and usage data, coarse location etc.
Asela Waidyalankara, a cybersecurity professional is of the view that the new Terms of Service (ToS) by WhatsApp is a “final nail in the coffin” when it comes to data privacy and secure communication as most Sri Lankan users of social media are not aware of how their data is being collected by these tech companies to make ad revenues.
“Under the new ToS, WhatsApp messages will continue to be end to end encryption mode but various data about users such as type of device, contacts, Operating System (OS), details of frequent calls would be extracted and integrated among the products of Facebook,” Mr Waidyalankara told the Sunday Times explaining the example of how a new contact a user saves in his/her messaging app results hours later by a friend suggesting the same person on Facebook.
Noting that even though the country marked the highest literacy rate of 92 percent in the region, the digital literacy rate among citizens is relatively very low even though there are 6.9 million active internet users in the country. For social media tech companies- data is the oil, he added.
“People should be taught how not to overshare their personal details in the social media platforms which consider the users and their data as the product of these companies which are available freely to access. It is through our data they make ad revenues,” Mr Waidyalankara said while pointing out that following the new WhatsApp privacy policy, many concerned users migrated to other secure apps such as Signal and Telegram which collect less data about the user.
Ravindu Meegasmulla, Information Security Engineer attached to Sri Lanka Computer Emergency Readiness Team (SLCERT) stressed that following the update on privacy, WhatsApp messages won’t be read or shared by any third party as believed but the two apple (Facebook and WhatsApp) would be able to extract a whole lot of personal data from users.
“The absence of necessary data protection and privacy laws in place is also one of the reasons why we can’t act proactively on data privacy. Currently CERT is engaged in conducting awareness programmes to educate the people on the importance of the topic,” Mr Meegasmulla said while stressing, since the pandemic hit the country, usage of social media increased exponentially and some 14,000 complaints related to social media have been lodged at the institution.
A Cyber Security Bill is still in the process of finalising the process under the Ministry of Technology which comes under the purview of President Gotabaya Rajapaksa and is yet to be approved by the Cabinet. During the previous government, discussions were also held to formulate a Data Protection Bill.
Following the new mandatory privacy update introduced by WhatsApp raised concerns of user privacy and data security many users moved to other alternative social messaging apps such as Signal and Telegram which do not extract data of users except the phone number. Even the phone number is not linked with the personal identity of the user.
Signal, an open source messaging application said that it has a record level of downloads around the world as many migrated to the platform for secure communication.
“Between WhatsApp announcing they would be sharing everything with the Facebook mothership and the Apple privacy labels that allowed people to compare us to other popular messengers, it seems many people are interested in private communication,” a message published by Signal developers said.
“As an organisation we work very hard to not know anything about you all. There aren’t analytics in the app, we use end to end encryption for everything from your messages and calls/video as well as all your metadata so we have no idea who you talk to or what you talk about.” the message read.